diff --git a/README.md b/README.md
index d171e3b..e1385a1 100644
--- a/README.md
+++ b/README.md
@@ -44,34 +44,34 @@ we can set up local listeners as proxy servers, and forward requests to internet
 <details>
 <summary>click to see details</summary>
 
-|Protocol     | Listen/TCP |  Listen/UDP | Forward/TCP | Forward/UDP | Description
-|:-:          |:-:|:-:|:-:|:-:|:-
-|Mixed        |√|√| | |http+socks5 server
-|HTTP         |√| |√| |client & server
-|SOCKS5       |√|√|√|√|client & server
-|SS           |√|√|√|√|client & server
-|Trojan       |√|√|√|√|client & server
-|Trojanc      |√|√|√|√|trojan cleartext(without tls)
-|VLESS        |√|√|√|√|client & server
-|VMess        | | |√|√|client only
-|SSR          | | |√| |client only
-|SSH          | | |√| |client only
-|SOCKS4       | | |√| |client only
-|SOCKS4A      | | |√| |client only
-|TCP          |√| |√| |tcp tunnel client & server
-|UDP          | |√| |√|udp tunnel client & server
-|TLS          |√| |√| |transport client & server
-|KCP          | |√|√| |transport client & server
-|Unix         |√|√|√|√|transport client & server
-|Smux         |√| |√| |transport client & server
-|Websocket(WS)|√| |√| |transport client & server
-|WS Secure    |√| |√| |websocket secure (wss)
-|Proxy Proto  |√| |√| |transport client & server
-|Simple-Obfs  | | |√| |transport client only
-|Redir        |√| | | |linux redirect proxy
-|Redir6       |√| | | |linux redirect proxy(ipv6)
-|Tproxy       | |√| | |linux tproxy(udp only)
-|Reject       | | |√|√|reject all requests
+|Protocol       | Listen/TCP |  Listen/UDP | Forward/TCP | Forward/UDP | Description
+|:-:            |:-:|:-:|:-:|:-:|:-
+|Mixed          |√|√| | |http+socks5 server
+|HTTP           |√| |√| |client & server
+|SOCKS5         |√|√|√|√|client & server
+|SS             |√|√|√|√|client & server
+|Trojan         |√|√|√|√|client & server
+|Trojanc        |√|√|√|√|trojan cleartext(without tls)
+|VLESS          |√|√|√|√|client & server
+|VMess          | | |√|√|client only
+|SSR            | | |√| |client only
+|SSH            | | |√| |client only
+|SOCKS4         | | |√| |client only
+|SOCKS4A        | | |√| |client only
+|TCP            |√| |√| |tcp tunnel client & server
+|UDP            | |√| |√|udp tunnel client & server
+|TLS            |√| |√| |transport client & server
+|KCP            | |√|√| |transport client & server
+|Unix           |√|√|√|√|transport client & server
+|Smux           |√| |√| |transport client & server
+|Websocket(WS)  |√| |√| |transport client & server
+|WS Secure      |√| |√| |websocket secure (wss)
+|Proxy Protocol |√| | | |version 1 server only
+|Simple-Obfs    | | |√| |transport client only
+|Redir          |√| | | |linux redirect proxy
+|Redir6         |√| | | |linux redirect proxy(ipv6)
+|Tproxy         | |√| | |linux tproxy(udp only)
+|Reject         | | |√|√|reject all requests
 
 </details>
 
@@ -184,7 +184,7 @@ glider -verbose -listen :8443 -forward SCHEME://HOST:PORT
 ```bash
 Available schemes:
   listen: mixed ss socks5 http vless trojan trojanc redir redir6 tproxy tcp udp tls ws wss unix smux kcp pxyproto
-  forward: direct reject ss socks4 socks5 http ssr ssh vless vmess trojan trojanc tcp udp tls ws wss unix smux kcp simple-obfs pxyproto
+  forward: direct reject ss socks4 socks5 http ssr ssh vless vmess trojan trojanc tcp udp tls ws wss unix smux kcp simple-obfs
 
 Socks5 scheme:
   socks://[user:pass@]host:port
@@ -208,7 +208,8 @@ SSH scheme:
   ssh://user[:pass]@host:port[?key=keypath]
 
 VMess scheme:
-  vmess://[security:]uuid@host:port?alterID=num
+  vmess://[security:]uuid@host:port[?alterID=num]
+    if alterID=0 or not set, VMessAEAD will be enabled
 
 VLESS scheme:
   vless://uuid@host:port[?fallback=127.0.0.1:80]
diff --git a/config.go b/config.go
index e8efb47..4eaa168 100644
--- a/config.go
+++ b/config.go
@@ -151,7 +151,7 @@ func usage() {
 
 	fmt.Fprintf(w, "Available schemes:\n")
 	fmt.Fprintf(w, "  listen: mixed ss socks5 http vless trojan trojanc redir redir6 tproxy tcp udp tls ws wss unix smux kcp pxyproto\n")
-	fmt.Fprintf(w, "  forward: direct reject ss socks4 socks5 http ssr ssh vless vmess trojan trojanc tcp udp tls ws wss unix smux kcp simple-obfs pxyproto\n")
+	fmt.Fprintf(w, "  forward: direct reject ss socks4 socks5 http ssr ssh vless vmess trojan trojanc tcp udp tls ws wss unix smux kcp simple-obfs\n")
 	fmt.Fprintf(w, "\n")
 
 	fmt.Fprintf(w, "Socks5 scheme:\n")
@@ -181,7 +181,8 @@ func usage() {
 	fmt.Fprintf(w, "\n")
 
 	fmt.Fprintf(w, "VMess scheme:\n")
-	fmt.Fprintf(w, "  vmess://[security:]uuid@host:port?alterID=num\n")
+	fmt.Fprintf(w, "  vmess://[security:]uuid@host:port[?alterID=num]\n")
+	fmt.Fprintf(w, "    if alterID=0 or not set, VMessAEAD will be enabled\n")
 	fmt.Fprintf(w, "\n")
 
 	fmt.Fprintf(w, "VLESS scheme:\n")
diff --git a/config/glider.conf.example b/config/glider.conf.example
index ab4b342..c31f0ae 100644
--- a/config/glider.conf.example
+++ b/config/glider.conf.example
@@ -125,21 +125,21 @@ listen=socks5://:1080
 # vless forwarder
 # forward=vless://5a146038-0b56-4e95-b1dc-5c6f5a32cd98@1.1.1.1:443
 
-# vmess with none security
+# vmess with aead auth
+# forward=vmess://5a146038-0b56-4e95-b1dc-5c6f5a32cd98@1.1.1.1:443
+
+# vmess with md5 auth (by setting alterID)
 # forward=vmess://5a146038-0b56-4e95-b1dc-5c6f5a32cd98@1.1.1.1:443?alterID=2
 
-# vmess with aes-128-gcm security
-# forward=vmess://aes-128-gcm:5a146038-0b56-4e95-b1dc-5c6f5a32cd98@1.1.1.1:443?alterID=2
-
 # vmess over tls
-# forward=tls://server.com:443,vmess://5a146038-0b56-4e95-b1dc-5c6f5a32cd98@?alterID=2
+# forward=tls://server.com:443,vmess://5a146038-0b56-4e95-b1dc-5c6f5a32cd98
 
 # vmess over websocket
-# forward=ws://1.1.1.1:80/path?host=server.com,vmess://chacha20-poly1305:5a146038-0b56-4e95-b1dc-5c6f5a32cd98@?alterID=2
+# forward=ws://1.1.1.1:80/path?host=server.com,vmess://chacha20-poly1305:5a146038-0b56-4e95-b1dc-5c6f5a32cd98
 
 # vmess over ws over tls
-# forward=tls://server.com:443,ws://,vmess://5a146038-0b56-4e95-b1dc-5c6f5a32cd98@?alterID=2
-# forward=tls://server.com:443,ws://@/path,vmess://5a146038-0b56-4e95-b1dc-5c6f5a32cd98@?alterID=2
+# forward=tls://server.com:443,ws://,vmess://5a146038-0b56-4e95-b1dc-5c6f5a32cd98
+# forward=tls://server.com:443,ws://@/path,vmess://5a146038-0b56-4e95-b1dc-5c6f5a32cd98
 
 # ss over tls
 # forward=tls://server.com:443,ss://AEAD_CHACHA20_POLY1305:pass@
diff --git a/go.mod b/go.mod
index 30c70ad..a6f1ce8 100644
--- a/go.mod
+++ b/go.mod
@@ -1,27 +1,34 @@
 module github.com/nadoo/glider
 
-go 1.16
+go 1.17
 
 require (
 	github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da
 	github.com/dgryski/go-camellia v0.0.0-20191119043421-69a8a13fb23d
 	github.com/dgryski/go-idea v0.0.0-20170306091226-d2fb45a411fb
 	github.com/dgryski/go-rc2 v0.0.0-20150621095337-8a9021637152
-	github.com/ebfe/rc2 v0.0.0-20131011165748-24b9757f5521 // indirect
 	github.com/insomniacslk/dhcp v0.0.0-20210621130208-1cac67f12b1e
-	github.com/klauspost/cpuid/v2 v2.0.9 // indirect
-	github.com/klauspost/reedsolomon v1.9.13 // indirect
-	github.com/mdlayher/raw v0.0.0-20210412142147-51b895745faf // indirect
 	github.com/nadoo/conflag v0.2.3
 	github.com/nadoo/ipset v0.3.0
-	github.com/tjfoc/gmsm v1.4.1 // indirect
-	github.com/u-root/uio v0.0.0-20210528151154-e40b768296a7 // indirect
 	github.com/xtaci/kcp-go/v5 v5.6.1
 	golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97
-	golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985 // indirect
 	golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c
 )
 
+require (
+	github.com/ebfe/rc2 v0.0.0-20131011165748-24b9757f5521 // indirect
+	github.com/klauspost/cpuid/v2 v2.0.9 // indirect
+	github.com/klauspost/reedsolomon v1.9.13 // indirect
+	github.com/mdlayher/ethernet v0.0.0-20190606142754-0394541c37b7 // indirect
+	github.com/mdlayher/raw v0.0.0-20210412142147-51b895745faf // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/templexxx/cpu v0.0.7 // indirect
+	github.com/templexxx/xorsimd v0.4.1 // indirect
+	github.com/tjfoc/gmsm v1.4.1 // indirect
+	github.com/u-root/uio v0.0.0-20210528151154-e40b768296a7 // indirect
+	golang.org/x/net v0.0.0-20210226172049-e18ecbb05110 // indirect
+)
+
 // Replace dependency modules with local developing copy
 // use `go list -m all` to confirm the final module used
 // replace (
diff --git a/go.sum b/go.sum
index b3121ae..e1de379 100644
--- a/go.sum
+++ b/go.sum
@@ -128,9 +128,8 @@ golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81R
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110 h1:qWPm9rbaAMKs8Bq/9LRpbMqxWRVUAQwMI9fVrssnTfw=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985 h1:4CSI6oo7cOjJKajidEljs9h+uP0rRZBPPPhcCbj5mw8=
-golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -153,7 +152,6 @@ golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20201009025420-dfb3f7c4e634/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201101102859-da207088b7d1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210525143221-35b2ab0089ea/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c h1:F1jZWGFhYfh0Ci55sIpILtKKK8p3i2/krTr0H1rg74I=
@@ -162,7 +160,6 @@ golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=